* feat(server): add /api/health endpoints with DB liveness check

The application has no /health endpoint today, which makes it
awkward to wire up Kubernetes livenessProbe / readinessProbe or
Docker HEALTHCHECK directives. /api/app/status is not a substitute
because it also exercises the GitHub releases API.

Add three endpoints under /api/health:

  - GET /api/health       — combined: 200 with database=ok, or 503
                            with database=unreachable.
  - GET /api/health/live  — liveness: 200 as long as the process is
                            up, no DB call. Use for Kubernetes
                            livenessProbe (no restarts on transient
                            DB blips).
  - GET /api/health/ready — readiness: SELECT 1 against the
                            configured TypeORM datasource; returns
                            503 if the query fails. Use for
                            Kubernetes readinessProbe (stop
                            sending traffic until the DB is back).

The DB check uses the same TypeORM datasource the rest of the app
uses, so a misconfigured connection string or a full disk surfaces
as a clear 503 rather than a silent 200.

* refactor(server): move health DB check to a service; add tests and Docker HEALTHCHECK

- Extract the SELECT 1 ping into HealthService so the controller only shapes the
  response, matching the controllers-delegate-to-services pattern.
- Log the caught DB error via MaintainerrLogger (warn + debug) instead of
  swallowing it.
- Use process.uptime(); drop the instantiation-time uptime helper.
- Move the response shapes to @maintainerr/contracts (LivenessResponse,
  HealthResponse); live() returns the shared envelope; root route uses @get().
- Add HealthService and HealthController specs.
- Wire the Dockerfile HEALTHCHECK to /api/health/ready via a BASE_PATH-aware
  probe script.

---------

Co-authored-by: enoch85 <mailto@danielhansson.nu>

#3046)

When the collection block is omitted from PUT /api/rules, fall back to the
saved values for manualCollection, manualCollectionName, visibleOnHome and
visibleOnRecommended instead of forwarding undefined. This stops
updateCollection from silently unlinking a manual collection (mediaServerId
cleared) or switching off Plex Home/Recommended visibility.

Follow-up to #3045.

Operators can override the persisted log level for a single container by
setting LOG_LEVEL=debug|verbose|info|warn|error|fatal in the environment.
The persisted setting (the value the UI shows) is left untouched, so the
override is never baked into the database. An unrecognised value logs a
single warning at startup and falls back to the persisted level; with the
env var unset, behaviour is unchanged.

The winston factory now also tolerates a missing log_settings row during
first boot, falling back to the shared DEFAULT_LOG_* constants for level,
max size, and max files instead of dereferencing a null row.

Co-authored-by: enoch85 <mailto@danielhansson.nu>

User-configured notification URLs were passed straight to axios.post, so a
misconfigured value pointing at file://, gopher://, or any other non-http(s)
scheme would be turned into an outbound request. These URLs have no validation
at the settings layer, so this is the only guard.

Add a shared validateWebhookUrl helper and apply it in every agent that posts
to an operator-supplied URL: the webhookUrl agents (webhook, slack, lunasea,
discord) and ntfy's server url. Unparseable URLs and non-http(s) schemes are
rejected before sending and the normalised URL is posted; the agent returns a
clear Failure result.

Also replace ntfy's regex slash-trimming with the codebase's char-based idiom,
per the no-regex convention.

Co-authored-by: enoch85 <mailto@danielhansson.nu>